Introduction

This class library allows access to the Win32 security calls in a .NET friendly way. It encapsulates the concepts of a user, a securable object (like a file, named pipe, directory, etc.), and permissions. This library was written in Managed C++ to simplify the amount of work needed to link to existing Win32
libraries. However, since it exposes all of its functionality via .NET, it can be used from any .NET compliant language, including C# and Visual Basic. The project was written and compiled with Visual Studio 2002.

This article outlines the primary objects in the library and their use in manipulating security objects.

Documentation

WindowsUser class

This class represents a single Windows identity (SID). It can be created by
specifying either a username ("DOMAIN\user" format) or the string representation
of a SID ("S-1-5-xxxx-xxx..."). You can also get the identity of the current
user using the static property CurrentUser.

There are a number of predefined identities that exist as static members of a
child class called WellKnownIdentities. Once you have an identity,
you can get the following properties:

AccountName: string name of the account

Domain: string name of the account's domain

FullName: string in the form of "Domain\AccountName"

SidString: string representation of the SID

SecuredObject class

This class represents an object which can have a security descriptor. It can
be created by specifying the name of the resource along with its type or by
passing a handle (as an IntPtr) to the resource.

Once you have the object, you can update the permissions, audit information,
owner and group.

PermissionsList

This class encapsulates actions on the ACL. It allows granting, revoking,
changing, and denying access levels to different users. Derived from
AccessList, which is a collection class for AccessEntry.

AuditingList

This class encapsulates actions on the auditing list of an object. It allows
getting and setting audit success and failure rights. Derived from AccessList, which is a collection class for AccessEntry.

AccessEntry

This class encapsulates the Access Control Entry or ACE. You can set the
user (trustee) and the associated rights and inheritance.

Example

This code shows the library in action. It assumes you have aliased the Microsoft.Win32.Security namespace (using in C#, Imports in VB).

Comments and Discussions

Hi,I have an asp application that needs to launch PowerPoint.At installation, i would like to give the "ASPNET" account the ability to launch and executePowerpoint.I tried with the following code below but It just allows this account to "read" the registry key.

Do you have any idea or where to modify to allow "Execution" from "ASPNET" account ?Thanks.Karim